Cisco 2911

To Next Page

To Previous Page

154

Cisco 3900 Series, Cisco 2900 Series, and Cisco 1900 Series Integrated Services Routers Generation 2 Software Configuration Guide

Chapter Configuring Security Features

SGT over Ethernet Tagging

Main Page

Overview of the Hardware and Software9
Feature Information10
New Features by Platform12
New Slots12
Cisco 2900 Series Isrs13
Cisco 3900 Series Isrs13
New Slots and Ports by Platform13
Cisco 1900 Series Isrs14
Common Ports14
Getting Started15
IOS Commands16
Table of Contents21
Basic Router Configuration21
Default Configuration22
Configuring Global Parameters23
Configuring I/O Memory Allocation24
Interface Ports25
Configuring Gigabit Ethernet Interfaces26
- Configuring a Loopback Interface27
- Configuring Interface Card and Module Interfaces27
Configuring Wireless LAN Interfaces27
Verifying Configuration28
Configuring Command-Line Access29
Configuring Static Routes31
Configuring Dynamic Routes33
- Configuring Routing Information Protocol33
- Configuring Enhanced Interior Gateway Routing Protocol35
- Configuring a Network Interface Device on the L3 Interface37
- Configuring the NID37
- Troubleshooting the NID Configuration39
- Verifying the NID Configuration39
- Ethernet Data Plane Loopback40
- Restrictions for Configuring External Ethernet Data Plane Loopback40
- Configuring External Ethernet Data Plane Loopback41
- Configuration Examples for Ethernet Data Plane Loopback43
Session ID43
- Verifying the Ethernet Data Plane Loopback Configuration44
- Troubleshooting the Ethernet Data Plane Loopback Configuration45
- CFM Support on Routed Port and Port MEP46
- Configuring Ethernet CFM (Port MEP)46
Level46
- Restrictions for Configuring Ethernet CFM46
- Configuration Example for Ethernet CFM (Port MEP)48
- Verifying the Ethernet CFM Configuration on a Port MEP48
- Configuring Ethernet CFM (Single-Tagged Packets)52
- Verifying the Ethernet CFM Configuration for Single-Tagged Packets54
- Configuring Ethernet CFM (Double-Tagged Packets)56
- Configuration Example for Ethernet CFM (Double-Tagged Packets)58
- Verififying the Ethernet CFM Configuration for Double-Tagged Packets58
- Configuring Two-Way Delay Measurement62
- Restrictions for Configuring Two-Way Delay Measurement62
- Support for Y.1731 Performance Monitoring on a Routed Port62
- Configuration Examples for Two-Way Delay Measurement64
- Verifying Two-Way Delay Measurement Configuration64
- Troubleshooting Two-Way Delay Measurement Configuration67
- Configuring an EFP and a BD on the Cisco ISR G2 Router69
- Configuring Ethernet Virtual Connection Bridge Domain69
- Configuring Evcs on Cisco ISR G2 Router69
- Configuration Examples for Evcs on the Cisco ISR G2 Router71
- Configuring Ethernet Data Plane Loopback72
- Features Supported for Ethernet Data Plane Loopback72
Configuring Ethernet CFM76
- Connectivity Fault Management (CFM) over EVC BD76
- Provisioning Service (CE-A)81
- Provisioning Service (CE-B)84
- Configuring and Enabling the Cross-Check Function (CE-B)88
- Support for Y.1731 Performance Monitoring for EVC BD95
- Configuration Examples to Add an Access Port SVI to a BD99
- Configuring SVI as Access Port99
- Restrictions for SVI Support on Bds99
- EVC Quality of Service (Qos)100
- Configuring Etherchannel101
- Restrictions and Guidelines for Etherchannel Feature101
- Understanding Etherchannel Feature101
- Configuring Backup Data Lines and Remote Management105
- Configuring Backup Interfaces105
- Assigning Primary and Secondary Failover Media107
- Configuring Gigabit Ethernet Failover Media107
- Enabling Auto-Detect108
- Configuring Cellular Dial-On-Demand Routing Backup109
- Configuring DDR Backup Using Dialer Watch110
- Cellular Wireless Modem as Backup with NAT and Ipsec Configuration112
- Configuring ISDN Settings125
- Configuring Third-Party Sfps129
- Configuring Power Efficiency Management133
- Modules and Interface Supporting Energywise133
- Restrictions for Power Efficiency Management and OIR134
- Configuring Security Features135
- Configuring SSL VPN135
- Configuring the Cryptographic Engine Accelerator135
- Authentication, Authorization, and Accounting136
- Configuring Autosecure136
- Access Groups137
- Configuring Access Lists137
- Configuring Cisco IOS Firewall138
- Zone-Based Policy Firewall138
- Configuring Cisco IOS IPS139
- Configuring VPN139
- Content Filtering139
- Remote Access VPN Using Ipsec Tunnel140
- Site-To-Site VPN Using an Ipsec Tunnel and GRE141
- Configure a VPN over an Ipsec Tunnel142
- Configure the IKE Policy143
- Configure Group Policy Information144
- Apply Mode Configuration to the Crypto Map146
- Enable Policy Lookup147
- Configure Ipsec Transforms and Protocols148
- Configure the Ipsec Crypto Method and Parameters149
- Apply the Crypto Map to the Physical Interface150
- Create a Cisco Easy VPN Remote Configuration151
- Configure a Site-To-Site GRE Tunnel154
- Configuring Dynamic Multipoint VPN157
- Configuring Group Encrypted Transport VPN158
- Restrictions for SGT over Ethernet Tagging159
- SGT over Ethernet Tagging159
- Example: Configuring SGT over Ethernet Tagging161
- Verifying SGT over Ethernet Tagging161
- Authentication Methods163
- Configuring Identity Features on Layer 3 Interface163
- Configuring the IEEE 802.1X163
- Verifying the IEEE 802.1X164
- Configuring the MAC Authentication Bypass (MAB)165
- Verifying the MAB166
- Configuring the Controlling Port Authorization State167
- Controlling Port Authorization State167
- Verifying the Controlling Port Authorization State168
- Configuring Flexible Authentication170
- Flexible Authentication170
- Host Mode170
- Open Access170
- Configuring Control-Direction (Wake-On-LAN)171
- Control-Direction (Wake-On-LAN)171
- Verifying Default Control-Direction Setting-Both173
- Configuring the Preauthentication Access Control List174
- Preauthentication Access Control List174
- Verifying Authentication Control-Direction Setting-In174
- Downloadable Access Control List175
- Filter-ID or Named Access Control List175
- IP Device Tracking175
- Unified Communications on Cisco Integrated Services Routers177
- Call Control178
- Cisco Unified Communications Manager Express178
- Modules and Interface Cards178
- Unified Survivable Remote Site Telephony179
- Call Control Protocols180
- Cisco Unified SIP Proxy (CUSP)180
- Gatekeeper180
- Trunk-Side Protocols180
- Line-Side Protocols181
- Media Gateway Control Protocol (MGCP)181
- Session Initiation Protocol (SIP)181
- SCCP-Controlled Analog Ports with Supplementary Features182
- Unified Communications Gateways182
- TDM Gateways183
- Voice Gateways183
- Cisco Unified Border Element184
- Unified Messaging Gateway184
- Conferencing, Transcoding and Media Termination Point (MTP)185
- IP Media Services185
- RSVP Agent185
- Trusted Relay Point (TRP)185
- Packet Voice Data Module186
- UC Trusted Firewall186
- Voice Security186
- Applications and Application Interfaces (Apis)187
- Signaling and Media Authentication and Encryption187
- Virtual Route Forward187
- Cisco Unity Express188
- Voice XML188
- Cisco Application Extension Platform189
- Hoot-N-Holler189
- Gatekeeper Transaction Message Protocol (GKTMP)190
- Online Insertion and Removal190
- Configuring Next-Generation High-Density PVDM3 Modules193
- DSP Resource Manager Enhancement and DSP Numbering195
- DSP Image for the PVDM3196
- Conferencing197
- DSP Farm Profiles197
- DSP Farms197
- Broadcast Fast Busy Tone for DSP Oversubscription198
- TDM Sharing/Pooling Configuration202
Transmitted208
- Show Running-Config: Example210
- Configuring Multi-Gigabit Fabric Communication219
- Restrictions for Module and Interface Card Communication219
- Supported Slots, Modules, and Interface Cards219
- Cisco Etherswitch Service Modules220
- Wireless LAN Module in the Cisco 1941W ISR220
- Cisco High-Speed Intrachassis Module Interconnect (HIMI)221
- Viewing Module and Interface Card Status on the Router222
- Viewing Platform Information222
- Viewing VLAN and Slot Assignments222
- Viewing Multi-Gigabit Fabric Statistics223
- Viewing Multi-Gigabit Fabric CPU Port Statistics224
- Restrictions for Upgrading the System Image225
- Upgrading the Cisco IOS Software225
- Information about Upgrading the System Image226
- Why Would I Upgrade the System Image?226
- Saving Backup Copies of Your Old System Image and Configuration228
- Ensuring Adequate DRAM for the New System Image229
- Ensuring Adequate Flash Memory for the New System Image231
- Copying the System Image into Flash Memory234
- Loading the New System Image240
- Saving Backup Copies of Your New System Image and Configuration245
- Define the WAN Interface on the Router247
- How to Upgrade the IOS Image on the Access Point247
- Confirm Connectivity and Settings248
- Secure an IP Address on the Access Point248
- Upgrading the IOS Image on the Access Point249
- Software Modes251
- Wireless Device Overview251
- Management Options252
- Network Configuration Examples252
- Root Access Point252
- Central Unit in an All-Wireless Network253
- Configuring the Wireless Device255
- Starting a Wireless Configuration Session255
- Configuring Wireless Settings257
- Cisco Express Setup258
- Cisco IOS CLI258
- Configuring the Radio258
- Configuring Authentication259
- Configuring Wireless Security Settings259
- Assigning Ssids260
- Configuring WEP and Cipher Suites260
- Configuring Wireless Vlans260
- Types of SSID Security261
- Configuring Wireless Quality of Service262
- Configuring the Access Point in Hot Standby Mode263
- Preparing for the Upgrade263
- Upgrading to Cisco Unified Software263
- Performing the Upgrade264
- Downgrading the Software on the Access Point265
- Recovering Software on the Access Point265
- Troubleshooting an Upgrade or Reverting the AP to Autonomous Mode265
- Configuring Radio Settings269
- Enabling the Radio Interface269
- Configuring the Role in the Radio Network271
- Configuring Dual-Radio Fallback273
- Radio Tracking273
- Configuring Radio Data Rates274
- Fast Ethernet Tracking274
- MAC-Address Tracking274
Interface Configuration275
- Configuring MCS Rates277
- Data Rates Based on MCS Settings, Guard Interval, and Channel Width278
- Configuring Radio Transmit Power279
- Limiting the Power Level for Associated Client Devices279
- 802.11N Channel Widths281
- Configuring Radio Channel Settings281
- Dynamic Frequency Selection282
- Cli Commands284
- Confirming that DFS Is Enabled284
- Configuring a Channel285
- Blocking Channels from DFS Selection286
- Simulating Radar Detection286
- Enabling and Disabling World Mode287
- Setting the 802.11N Guard Interval287
- Disabling and Enabling Short Radio Preambles289
- Configuring Transmit and Receive Antennas290
- Enabling and Disabling Gratuitous Probe Response291
- Disabling and Enabling Aironet Extensions292
- Configuring the Ethernet Encapsulation Transformation Method293
- Enabling and Disabling Public Secure Packet Forwarding294
- Configuring Protected Ports295
- Configuring the Beacon Period and the DTIM296
- Configure RTS Threshold and Retries297
- Configuring the Fragmentation Threshold298
- Configuring the Maximum Data Retries298
- Enabling Short Slot Time for 802.11G Radios299
- Performing a Carrier Busy Test299
- Configuring Voip Packet Handling300
- Administering the Wireless Device303
- Preventing Unauthorized Access to Your Access Point305
- Protecting Access to Privileged EXEC Commands305
- Configuring Default Password and Privilege Level306
- Setting or Changing a Static Enable Password306
- Protecting Enable and Enable Secret Passwords with Encryption307
- Configuring Username and Password Pairs309
- Configuring Multiple Privilege Levels310
- Setting the Privilege Level for a Command311
- Logging into and Exiting a Privilege Level312
- Configuring RADIUS Login Authentication313
- Controlling Access Point Access with RADIUS313
- Default RADIUS Configuration313
- Defining AAA Server Groups315
- Network Services317
- Controlling Access Point Access with TACACS+318
- Displaying the Radius Configuration318
- Configuring TACACS+ Login Authentication319
- Default TACACS+ Configuration319
- Administering the Wireless Hardware and Software322
- Rebooting the Wireless Device322
- Resetting the Wireless Device to the Factory Default Configuration322
- Managing the System Time and Date323
- Monitoring the Wireless Device323
- Configuring Time and Date Manually324
- Understanding Simple Network Time Protocol324
- Displaying the Time and Date Configuration325
- Setting the System Clock325
- Configuring Summer Time (Daylight Saving Time)326
- Configuring the Time Zone326
- Configuring a System Name and Prompt329
- Default System Name and Prompt Configuration329
- Understanding DNS330
- Default DNS Configuration331
- Setting up DNS331
- Creating a Banner332
- Displaying the DNS Configuration332
- Configuring a Message-Of-The-Day Login Banner333
- Default Banner Configuration333
- Configuring a Login Banner334
- Configuring Ethernet Speed and Duplex Settings335
- Configuring the Access Point for Wireless Network Management336
- Configuring the Authentication Cache and Profile338
- Configuring the Access Point to Provide DHCP Service340
- Setting up the DHCP Server340
- Monitoring and Maintaining the DHCP Server Access Point342
- Show Commands342
- Clear Commands343
- Configuring the Access Point for Secure Shell343
- Debug Command343
- Understanding SSH343
- Configuring Client ARP Caching344
- Configuring SSH344
- Optional ARP Caching344
- Understanding Client ARP Caching344
- Configuring ARP Caching345
- Cisco IOS CLI for Initial Configuration347
- Configuring the Router Hostname348
- Using the Cisco IOS CLI to Perform Initial Configuration348
- Configuring the Enable and Enable Secret Passwords349
- Configuring the Console Idle Privileged EXEC Timeout351
- IP Routing354
- Specifying a Default Route or Gateway of Last Resort354
- Default Network355
- Default Routes355
- Gateway of Last Resort355
- Configuring Virtual Terminal Lines for Remote Console Access357
- Configuring the Auxiliary Line359
- Verifying Network Connectivity360
- Saving Backup Copies of Configuration and System Image362
- Saving Your Router Configuration362
- Compactflash Support365
- Formatting Compactflash365
- Requirements and Restrictions365
- Using Compactflash Memory Cards365
- Determining the File System on a Compactflash Memory Card366
- How to Format Compactflash Memory Cards366
- Formatting Compactflash Memory as a Class C File System367
- Copying Files368
- File Operations on Compactflash Memory Cards368
- Displaying File Content369
- Displaying Files369
- Privileged Exec Mode369
- Deleting Files370
- Displaying Geometry and Format Information370
- Renaming Files370
- Directory Operations on a Compactflash Memory Card371
- Entering a Directory and Determining Which Directory You Are in371
- Creating a New Directory372
- Removing a Directory373
- Information about the ROM Monitor375
- ROM Monitor Mode Command Prompt375
- Using ROM Monitor375
- Tips for Using ROM Monitor Commands376
- When Do I Use ROM Monitor?376
- Why Is the Router in ROM Monitor Mode?376
- Accessibility377
- Entering ROM Monitor Mode377
- How to Use the ROM Monitor—Typical Tasks377
- Setting the Configuration Register to Boot to ROM Monitor Mode379
- Displaying Files in a File System (Dir)382
- Loading a System Image (Boot)382
- Modifying the Configuration Register (Confreg)387
- Obtaining Information on USB Flash Devices388
- Modifying the I/O Memory (Iomemset)389
- Recovering the System Image (Tftpdnld)390
- Troubleshooting Crashes and Hangs394
- ROM Monitor Console Communication Failure395
- Router Crashes395
- Router Hangs395
- Exiting ROM Monitor Mode399
- Troubleshooting Tips399
- Changing the Configuration Register Settings403
- Configuring the Console Line Speed (Cisco IOS CLI)407
- Displaying the Configuration Register Settings407

Table of Contents

Other manuals for Cisco 2911

Related product manuals